Cabo Verde

Cabo Verde was the continent's earliest mover: its Law No. 133/V/2001 of 22 January 2001 is Africa's first comprehensive data protection statute, enacted a decade ahead of most peers. It established foundational principles and created the Comissão Nacional de Protecção de Dados (CNPD), and has been progressively modernised. Law No. 42/VIII/2013 reformed the CNPD's institutional framework (the CNPD became fully operational in 2015), and Law No. 121/IX/2021, in force from April 2021, aligned the regime with the GDPR and Convention 108+, introducing extraterritorial scope, portability and erasure rights, a 72-hour breach-notification duty with notice to affected individuals for high-risk breaches, and DPO appointment in certain circumstances. The law applies to automated processing and structured manual files for all natural and legal persons established in Cabo Verde. Processing is subject to prior notification or authorisation depending on sensitivity, with sensitive categories (health, biometrics, racial origin, criminal convictions, sexual life) requiring prior CNPD authorisation. Cross-border transfers require adequacy or appropriate safeguards. Enforcement rests with the CNPD, an independent authority empowered to receive notifications and authorisations, inspect, decide complaints, and impose administrative fines and criminal referrals. The trajectory, pioneering 2001 statute, 2013 institutional reform, and 2021 GDPR-style modernisation, makes Cabo Verde both the earliest and one of the more up-to-date small-state regimes on the continent, distinctive in having kept its long-standing law current rather than letting it ossify.